Search: “National Cryptologic Foundation”

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net Security·07:40 UTC · 2h agoAdvisory 2 sources

Exclusive: NSA to host a hacker reunion in bid to rebuild secretive unit

NSA will host a reunion of former Tailored Access Operations hackers as it moves to rebuild and rebrand the elite unit.

The invitation-only event at Fort Meade, spearheaded by Deputy Director Tim Kosiba, a former TAO technical director, will tour the new TAO building and pitch alumni to return. TAO, credited with contributions to Stuxnet and once grown to over 2,000 personnel, was renamed Computer Network Operations about a decade ago, and the recent reshuffle undid some of those changes after NSA lost roughly 2,100 staff (8% of its workforce) last year.

The Record·Aug 26, 20:56 UTC · 20d agoIndustry

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.

CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.

CISA Advisories·Sep 15, 12:00 UTC · 22h agoAdvisory

New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs

ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.

The N0va phishkit uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into a device code authentication flow. After the user completes legitimate authentication, N0va captures access and refresh tokens and abuses token-exchange and device-registration mechanisms to establish persistent SSO access to corporate resources. Because the flow relies on real Microsoft authentication, it can evade MFA-focused detections, and token access can outlive takedown of the phishing page. ANY.RUN says it observed the campaign in sandbox sessions, with targeting spanning government, technology, consulting, and healthcare sectors.

Cyber Security News·updated Sep 11, 17:26 UTC · 4d ago·first Sep 9, 16:26 UTC · 6d agoPhishing & fraud in the wild 13 sources

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security News·Sep 15, 17:04 UTC · 16h agoAdvisory1

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · security·Sep 9, 06:47 UTC · 7d agoResearch

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN·Aug 26, 09:17 UTC · 21d agoPhishing & fraud in the wild

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 Blog·Aug 17, 11:29 UTC · 29d agoPhishing & fraud

GAUGE: A Formal Framework for Measuring Cryptographic Security under Heterogeneous Adversary Cost Models

GAUGE frames cryptographic security as profiles over adversary cost models, certifying a ranking reversal between ML-KEM-512 and AES-128 from a 4–5% memory pricing shift.

GAUGE represents cryptographic security as a function over admissible adversary cost models (a security profile), proves profiles are piecewise-linear and concave, and establishes a rating trilemma when two profiles cross. A polynomial-time linear-programming procedure certifies whether the ranking of two schemes is robust, reverses under admissible models, or is genuinely incomparable. Applied to NIST post-quantum standards, the framework certifies a ML-KEM-512 versus AES-128 ranking reversal from a 4–5% shift in memory pricing and measures lattice-sieving cost drift of 9.79 bits per year over eight years. A hybrid X25519 + ML-KEM-768 handshake reduces combined-break probability twenty-fold at a 2.3 kilobyte cost.

arXiv cs.CR·Sep 15, 14:55 UTC · 19h agoResearch

Post-quantum cryptography adoption and the national security implications

Opinion analysis argues quantum computing favors nation-state espionage, leaving lagging post-quantum adoption at critical infrastructure exposed to harvest-now-decrypt-later attacks.

A CSO Online opinion piece argues that the extreme cost and infrastructure requirements of quantum computers will concentrate cryptographically relevant quantum capability among nation-states and a few corporations, favoring espionage and economic espionage over criminal monetization. It highlights harvest-now-decrypt-later risk to long-lived secrets, expert warnings such as Filippo Valsorda's, and diverging CRQC timelines with Google suggesting possibly 2029. The piece predicts governments, banks, and targeted sectors will adopt PQC first while utilities, small hospitals, and local government lag, widening exploitable gaps in critical infrastructure reminiscent of Salt Typhoon-style access.

CSO Online·Sep 9, 09:00 UTC · 7d agoIndustry

Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research

Researchers release NEST-Phish, a synthetic enterprise phishing email dataset with matched legitimate and phishing emails and cue annotations for detection research.

Academic researchers introduce NEST-Phish, a publicly released synthetic enterprise phishing email dataset built around a fictitious organization named Nebulon. It contains matched synthetic legitimate and phishing emails across a broad set of workplace communication themes, each with interpretable phishing-cue annotations. Human-subject categorizations and supervised classifier evaluations indicate the dataset supports meaningful variation in phishing judgments and provides learnable signal for detection models. It is intended to support work on phishing detection, human susceptibility, explainability, and benchmark development.

arXiv cs.CR·Sep 3, 20:58 UTC · 12d agoResearch

Dissecting the JWR phishing framework

Cisco Talos uncovered an undocumented phishing framework branded JWR that impersonates checkout and login pages of major payment and shopping platforms.

Cisco Talos researchers identified an undocumented phishing framework internally branded JWR by its developer. The framework is built to convincingly impersonate checkout and login pages across major payment and shopping platforms, likely to harvest credentials and payment details. Talos's analysis details the framework's infrastructure and impersonation capabilities, giving defenders indicators to detect campaigns using it.

Cisco Talos·Aug 13, 10:00 UTC · Aug 13, 2026Phishing & fraud

U.S. CISA adds a N-able N-central flaw to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 4, 11:02 UTC · Aug 4, 2026Exploit / PoC in the wildCVE-2026-18577CVE-2026-18556

Understanding the Usability of Cryptographic Verification Tools

Survey of Tamarin and ProVerif users reveals usability barriers: debugging non-termination, model validation, and opaque proof failures hinder cryptographic protocol verification.

The paper presents an exploratory human-centered survey of researchers, graduate students, and practitioners with hands-on experience using Tamarin, ProVerif, and related cryptographic protocol verification tools. Findings reveal usability barriers across the verification workflow, including difficulties debugging non-termination and performance issues plus the lack of systematic methods for validating formal models against real protocols. When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions. Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.

arXiv cs.CR·Sep 14, 20:40 UTC · 1d agoResearch

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUN·Sep 8, 10:24 UTC · 7d agoMalware in the wild

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News·Sep 7, 03:42 UTC · 9d agoPhishing & fraud in the wild1

U.S. CISA adds PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

CISA added two actively exploited PaperCut NG/MF pre-auth flaws to the KEV catalog; federal agencies must patch by September 14.

CISA added CVE-2026-81578 (CVSS 8.8, missing authentication for critical function) and CVE-2026-82078 (CVSS 9.4, unsafe reflection) in PaperCut NG/MF to its Known Exploited Vulnerabilities catalog. Huntress confirmed active pre-authentication RCE exploitation in two customer environments and reproduced the full chain against a clean PaperCut NG 25.0.11 server, chaining the auth bypass into unsafe Java class loading for SYSTEM-level execution. About 47% of roughly 2,500 tracked PaperCut installs still run version 23 or earlier with no patch available, and observed attacker activity was limited to system discovery commands.

Security Affairs·Sep 1, 08:13 UTC · 15d agoVulnerability in the wildCVE-2026-81578CVE-2026-82078

Entrust turns cryptographic inventory data into security action

Entrust adds CBOM import/export, Ansible automation, and post-quantum readiness features to its Cryptographic Security Platform.

Entrust announced new capabilities for its Cryptographic Security Platform, including CBOM import/export to build cryptographic inventories, correlate assets and dependencies, and prioritize remediation of noncompliant or vulnerable crypto. New Ansible-based automation extends certificate lifecycle management across public and private PKI, while composite algorithm and SPIRE-based capabilities support phased post-quantum migration and trusted identities for AI agents. The platform is now deployable as-a-service or on-premises, aligning with DORA, NIS2, and recent U.S. post-quantum requirements.

Help Net Security·Sep 14, 13:54 UTC · 1d agoTools

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO Online·09:00 UTC · 1h agoPolicy & legal

USN-8742-1: Netty vulnerability

Ubuntu issues USN-8742-1 fixing a Netty DNS cache poisoning flaw caused by improper NS record bailiwick validation.

Ubuntu Security Notice USN-8742-1 addresses a vulnerability in the Netty framework in which NS records are incorrectly validated for bailiwick. An attacker could potentially exploit this to facilitate DNS cache poisoning attacks. Updated packages are available for supported Ubuntu releases.

Ubuntu Security Notices·updated Sep 11, 12:03 UTC · 4d ago·first Sep 10, 09:01 UTC · 6d agoAdvisory 13 sources

JSCeal Hides Crypto Malware in V8 Bytecode

Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.

JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.

Security Affairs·Sep 7, 10:19 UTC · 8d agoMalware1

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild

CISA added CVE-2026-86218 (CVSS 10.0), a pre-auth RCE in N-able N-central, to KEV after N-able confirmed in-the-wild exploitation; patch by September 11.

CISA added CVE-2026-86218, a maximum-severity static code injection flaw enabling pre-authentication remote code execution in N-able N-central, to its Known Exploited Vulnerabilities catalog with a September 11, 2026 deadline for federal agencies. The flaw is fixed in N-central 2026.3 Hotfix 4 (released September 5), and N-able told customers it has been observed being exploited in the wild. Separately, Huntress is investigating the compromise of a fully patched customer N-central environment on September 4 and cannot yet confirm which flaw was used, while Rapid7-disclosed CVE-2026-86206 and CVE-2026-86207 can be chained by an unauthenticated attacker to create a rogue System Administrator account.

The Hacker News·Sep 9, 04:27 UTC · 7d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207

A $25 template helped scammers build hundreds of phantom bank domains

Allure Security researchers found 838 live phantom bank sites sharing a $25 template, built to lend credibility to investment and romance scams.

Allure Security researchers discovered roughly 2,200 domains presenting invented banks, of which 1,095 returned working pages and 838 contained a shared phrase. 97% of those retained parts of the $25 Cuex front-end template and 94% ran Laravel, with a misspelled 'Curreny Charts' heading on 90% of sites. The sites presented login pages, session cookies, and anti-forgery tokens consistent with a fraud model where scam contacts direct victims to fake financial portals. A leftover 'Remedy bank' title and form submission to remedycodes[.]site linked some sites to already-flagged fraud infrastructure.

Help Net Security·Aug 21, 00:00 UTC · 26d agoPhishing & fraud

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.

Researchers from BCA LTD, NorthScan and ANY.RUN built a fake DeFi protocol called Ballena Azul and hired three suspected Famous Chollima operatives through a real recruiting pipeline. The hires submitted inconsistent or AI-processed identity documents, including a driver's license whose metadata showed Google Gemini processing and a SynthID watermark. On day one the workers profiled their assigned VMs, checked their egress country, and one installed Chrome Remote Desktop and logged into GitHub. The findings were presented at DEF CON 34 and align with a July 31 joint government alert on DPRK IT worker schemes.

The Hacker News·Aug 11, 12:48 UTC · Aug 11, 2026Threat actor

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security News·updated Sep 14, 09:43 UTC · 2d ago·first Sep 14, 05:11 UTC · 2d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUN·Aug 20, 07:58 UTC · 27d agoThreat actor

N-able N-central HF4 Fixes Critical RCE After Series of Authentication Flaws

N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) fixing CVE-2026-86218, a critical pre-authentication RCE.

N-able shipped N-central 2026.3 Hotfix 4 (build 2026.3.1.14) to patch CVE-2026-86218, a critical remote code execution vulnerability exploitable without authentication. The hotfix follows a series of authentication flaws discovered in the N-central platform. Organizations running N-central should apply the update promptly; the notice does not report active exploitation.

SOCRadar·Sep 7, 07:51 UTC · 9d agoVulnerabilityCVE-2026-86218